3 ms·
Enable certificate authentication only, and turn off password authentication. And you are safe. A million bots attacking a billion times won't break in. You do
by habibur 4y ago
Enable certificate authentication only, and turn off password authentication. And you are safe. A million bots attacking a billion times won't break in.
You don't need to put anymore security over it, like changing ssh port or running fail2ban, unless you want to reduce CPU load spent behind handling automated port scanners and bots.
- computerfriend 4y agoCertificate authentication is overkill and rolling it yourself is painful enough that huge companies have been built around it (Teleport). Unless you're an enterprise SSHer with tons of ephemeral hosts, use public keys instead.
- dewey 4y agoI'd guess they just talk about pub key authentication?
- Macha 4y agoI mean, it sounds like in OP's case it's 1 service instance to small N (maybe even 1) potential systems to deploy from. Manual SSH public key deployment doesn't scale to corporate scale, but it certainly scales that far
- radiator 4y agoIt does not look so painful. I have found this guide helpful [https://jameshfisher.com/2018/03/16/how-to-create-an-ssh-certificate-authority/ https://jameshfisher.com/2018/03/16/how-to-create-an-ssh-cer...]
- client4 4y agoCA isn't terribly difficult. https://keybase.io/blog/keybase-ssh-ca https://keybase.io/blog/keybase-ssh-ca
- marcosdumay 4y agoOr get a hardware token and add it to the authorized_keys. Depends on how many machines you have to setup.